Hacker News Reader

Comment by Johnny555 | Hacker News Reader

This is partly because HIPAA prohibits people from doing things they really want to do (emailing about a patient, perhaps to that patient) and partially because the requirements are so vague

My healthcare provider solves this by having a health portal that I log in to to send/receive messages to my doctor and view test results.

It's all SSL encrypted and protected with my individual password, which is more than they can guarantee with plain email. When I have a new message in the message center, they send me an email to tell me to log in.

I should hope that any healthcare provider that wants to share PHI with a patient does the same rather than using email, where they have no assurance that the email is encrypted, stored securely, or protected by a strong password.

View on HN

This is a great example of a HIPAA poser, because that system: still a violation if one treats the regulations as actually meaning what they say. The "We have a message for you" disclosed a doctor-patient relationship (protected health information) about an email address (personally identifiable).

It's unlikely they'll receive a complaint/investigation for installing that software.

I fail to see how the email discloses anything protected, since it's completely generic:

    Dear member,

    You have a new message from *Redacted Healthcare System*

    Please click on the link below, or copy and paste the link into your browser.

So from the email it's impossible to tell if it's even a message for me, or someone else in my household that I'm authorized to receive healthcare information for. And it hardly seems any more revealing than the weekly "wellness emails" that every healthcare system seems to send to its members.

HHS specifically allows a provider to use email:

The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so. See 45 C.F.R. § 164.530(c).

http://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipa...

Exactly. He's calling himself a poser with a claim like that. The use of protected portals with generic notifications is both allowed and widespread in use. Almost every provider I've run into does a variation of this. There's even turn-key solutions in this and other regulated markets. Incidentally, it was also the solution secure email providers came up with for when people don't have your encryption software but do have regular email & HTTPS-enabled browsers.

I'll go further to say it's probably one of the best models a company can use since vast majority of INFOSEC research and product development goes into exactly that sort of construction and tech. Even high assurance sector has solutions for some of that. Plus it has high usability and compatibility. Win across the board.

The patient would presumably consent first (to the notification emails).

Reply on news.ycombinator.com